Quick Look: A Real-World Example of Using Network Behaviour to Detect Cyber-Compromise

on YouTube ↗10m

" summary

ANZ Bank used data science and machine learning to detect advanced persistent threats by ingesting Netflow and DNS datasets and applying a machine learning algorithm to network behaviour. The work evolved to focus on SOC analyst usability and now aims to correlate weak signals across multiple data sources. Lessons include implementation experiences, shifting priorities as the programme matures, and aligning SOC priorities with project goals.

AI-written summary · about

" chapters (6)

1. 0:00Intro
2. 0:21DETECTION BASED ON BEHAVIOUR RATHER THAN SIGNATURE
3. 2:11PathScan Detects at Different Points in the Kill Chain
4. 4:52Extra Data Allows Extra Use Cases
5. 6:07The Delivery Model is Maturing
6. 6:55Normal Browsing and C2 Beaconing Can Have Different Patterns

" related talks

• 29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC DetectionCarole Boijaud · Black Hat Europe 2022
• 32mAI/Machine Learning: What is Actually Working in Cybersecurity?John Pescatore · RSAC 365 Virtual Summit 2021
• 55mKeynote - The Future of Cybersecurity Needs You, Here is Why.Verónica Valeros · PyData Berlin 2017
• 24mCan Big Data and Machine Learning Really Improve Network Operations?Srividya Iyer · Network Automation Summit at Interop 2020
• 46mKeynote Q&A – Verónica ValerosVerónica Valeros · PyData Berlin 2017
• 40mLearning Detection Indicators from Cyber Threat Intelligence and Their ApplicationsTsuyoshi Taniguchi · CODE BLUE 2017
• 20mCombatting Cyber Attacks Through Advanced Analytics & IntelligenceBryan Sartin · RSA Conference Asia Pacific & Japan 2014
• 16mIntelligent by design: Can cybersecurity cope with AI?Nicole Eagan · Collision 2017